AHMEDABAD: Gujarat Police has cracked an interstate cyber racket allegedly linked to bomb threat emails sent to government offices, educational institutions and courts across the state, arresting two accused from Bihar and Jharkhand.
The breakthrough came after the Gujarat Police Cyber Centre of Excellence launched a technical investigation into threatening emails targeting key government institutions and political leaders.
The operation, conducted across Gujarat, Bihar and Jharkhand, has also exposed a massive digital network. Police recovered a list containing 5,13,847 unique email IDs and their corresponding passwords from the two accused, raising concerns over the potential misuse of these accounts for cybercrime, threatening communications and other illegal activities.
The investigation began after a threatening email reached the Gujarat Government’s Legislative and Parliamentary Affairs Department at 9:47 AM on September 10, 2026.
According to the Gujarat Police, the email threatened bomb attacks on key locations and personalities, including the Gujarat Chief Minister’s Office, the Gujarat Legislative Assembly, Prime Minister Narendra Modi and Union Home Minister Amit Shah.
The threat message also reportedly mentioned countries cooperating with India in connection with the BRICS summit being held in the country.
Given the seriousness of the threats, Gujarat Police intensified its cyber investigation to trace the source of the email and identify those operating the network.
As investigators analysed the threatening email and tracked its digital footprints, the trail reportedly led to Bhagalpur in Bihar. Acting on the technical evidence, a Gujarat Police team, with assistance from Bhagalpur Police, arrested Roshan Kumar, alias Rajendra Kumar Bhumihar (Rai). During interrogation, Roshan allegedly revealed that the email ID used in the threatening communication had been provided to him by Gulshan Kumar Kaushal Singh, a resident of Deoghar in Jharkhand.
Following this lead, Gujarat Police teams deployed technical surveillance and field operations in Jharkhand, subsequently arresting Gulshan Kumar Kaushal Singh from Deoghar.
The seizure of 5,13,847 unique email IDs and passwords has emerged as one of the most significant findings in the case. According to the police, the accounts were allegedly intended for use in sending threatening emails to government offices, schools, colleges and courts, besides facilitating other cybercrimes.
Investigators also reportedly found that the accused used complex methods to create email accounts and bypass authentication processes. However, the police have not yet established how many of the recovered accounts were actually used to send bomb threats or how many individuals were affected.
The Gujarat Police is now conducting further technical analysis of the database to determine the origin, usage and possible reach of the email network.
Meanwhile, preliminary findings have reportedly pointed towards a possible Bangladesh connection in the operation.
According to the Gujarat Police, the network may have been receiving financial assistance and instructions from Bangladesh. Investigators are also examining the possible use of crypto wallets to transfer funds linked to the activities.
Police have further received information suggesting that the prime accused supplied large numbers of email IDs and passwords to other alleged anti-national elements. However, the suspected foreign connection and the alleged role of other individuals remain under investigation. The police have not yet publicly established the full funding chain, crypto transactions or the identities of all persons who may have received the email credentials.
The Gujarat Police Cyber Centre of Excellence led the investigation, while field operations were conducted simultaneously in Gujarat, Bihar and Jharkhand. The teams reportedly received substantial assistance from Gandhinagar Police, Bhagalpur Police and Deoghar Police.
Following directions from senior Gujarat Police officials, cyber investigators and field teams worked together.With two arrests and a large database of email credentials now in police custody, investigators are focusing on the remaining links in the syndicate and the possible misuse of the recovered accounts.
The Gujarat Police has appealed to the public not to panic upon receiving a threatening email. Instead, citizens should immediately inform the local police or contact the 1930 cybercrime helpline.
Police have also advised people not to delete the threatening email forward it, share screenshots, or circulate its details on social media. They have further warned against contacting the sender or responding to the message.